katipally/vscode-copilot-chat

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/extension/agents/vscode-node/test/askAgentProvider.spec.ts:145
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  package.json:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  package.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  package.json:10
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/extension/test/node/fixtures/gitdiff/03-large-many-changes.diff:10
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/extension/test/node/fixtures/gitdiff/03-large-many-changes.diff:11
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/extension/test/node/fixtures/gitdiff/03-large:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/extension/test/node/fixtures/gitdiff/03-large:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/platform/authentication/test/node/copilotToken.spec.ts:177
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/platform/authentication/test/node/copilotToken.spec.ts:185
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/platform/github/common/githubApiFetcherService.ts:376
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/platform/telemetry/node/azureInsights.ts:14
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/platform/telemetry/node/azureInsights.ts:15
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/platform/telemetry/test/node/telemetry2.spec.ts:49
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/platform/telemetry/test/node/telemetry2.spec.ts:67
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/platform/telemetry/test/node/telemetry2.spec.ts:82
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54285 @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
  chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54285 @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
  chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-12151 undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames
  chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-12151). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-6734 undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing
  chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-6734). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-9697 undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy
  chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9697). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-9678 undici: Undici: Information disclosure due to improper cache-control header parsing
  chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9678). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-9679 undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
  chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9679). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-34451 Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-34451). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41686 Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-41686). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41686 Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-41686). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45033 GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-45033). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48068 grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-48068). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48069 grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-48069). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39406 @hono/node-server: Middleware bypass via repeated slashes in serveStatic
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-39406). Fix: Update that package to its patched version.
• Worth fixing GHSA-frvp-7c67-39w9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
  package-lock.json
  A package you depend on has a known security hole (GHSA-frvp-7c67-39w9). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-46681 @nevware21/ts-utils: @nevware21/ts-utils: Arbitrary Code Execution via Prototype Pollution
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-46681). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54285 @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54285 @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44288 protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-14257 brace-expansion through 5.0.7 is vulnerable to denial of service via m ...
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45149 brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-45149). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41238 DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution
  package-lock.json
  A package you depend on has a known security hole (CVE-2026-41238). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
• Serious GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/package-lock.json
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/package-lock.json
  A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/package-lock.json
  A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
• Worth fixing GHSA-p7fg-763f-g4gf Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-41686). Fix: Update that package to its patched version.
• Worth fixing GHSA-8988-4f7v-96qf OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing GHSA-8988-4f7v-96qf OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
• Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
• Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
• Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
• Worth fixing GHSA-jxxr-4gwj-5jf2 brace-expansion: Large numeric range defeats documented `max` DoS protection
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-45149). Fix: Update that package to its patched version.
• Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
• Worth fixing GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
• Worth fixing GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-41305). Fix: Update that package to its patched version.
• Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-395f-4hp3-45gv shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-13311). Fix: Update that package to its patched version.
• Worth fixing GHSA-hm92-r4w5-c3mj undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-6734). Fix: Update that package to its patched version.
• Worth fixing GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9679). Fix: Update that package to its patched version.
• Worth fixing GHSA-pr7r-676h-xcf6 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
  /workdirs/scan-cca2ada7-fb70-4cb2-bbb2-79104a027aa1/chat-lib/package-lock.json
  A package you depend on has a known security hole (CVE-2026-9678). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout